Examkin

Soru

Zorluk: OrtaRisk Identification, Assessment, and Response Strategies

An enterprise risk manager is performing a quantitative risk assessment on a database cluster hosting proprietary research data with an Asset Value (AVAV) of 500,000500,000. Initial threat modeling indicates an Exposure Factor (EFEF) of 0.300.30 per ransomware event, with an estimated Annual Rate of Occurrence (AROARO) of 0.500.50. The Chief Information Security Officer (CISO) is evaluating an automated endpoint containment safeguard costing 20,00020,000 annually, which would reduce the EFEF to 0.100.10 while leaving the AROARO unchanged. What is the net annual cost-benefit (annual loss reduction minus safeguard cost) of deploying this security control?

  1. 30,00030,000 net annual savingsCevap
  2. B
    50,00050,000 net annual savings
  3. C
    100,000100,000 net annual savings
  4. D
    5,0005,000 net annual savings

Cevap

The net annual cost-benefit of implementing the security control is 30,00030,000 in net savings.
The baseline Annual Loss Expectancy (ALEALE) is 75,00075,000 (500,000 Asset Value×0.30 Exposure Factor×0.50 ARO500,000 \text{ Asset Value} \times 0.30 \text{ Exposure Factor} \times 0.50 \text{ ARO}). Deploying the safeguard reduces the EFEF to 0.100.10, yielding a modified ALEALE of 25,00025,000 (500,000×0.10×0.50500,000 \times 0.10 \times 0.50). The annual risk reduction (gross savings) is 50,00050,000 (75,000−25,00075,000 - 25,000). Subtracting the 20,00020,000 annual safeguard deployment cost provides a net annual financial benefit of 30,00030,000.

Adım Adım Çözüm

1
Calculate initial Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
SLEinitial=500,000×0.30=150,000SLE_{initial} = 500,000 \times 0.30 = 150,000; ALEinitial=150,000×0.50=75,000ALE_{initial} = 150,000 \times 0.50 = 75,000
Quantifies baseline financial risk exposure prior to applying the control.
2
Calculate post-control SLE and ALE with reduced Exposure Factor
SLEmodified=500,000×0.10=50,000SLE_{modified} = 500,000 \times 0.10 = 50,000; ALEmodified=50,000×0.50=25,000ALE_{modified} = 50,000 \times 0.50 = 25,000
Determines residual risk exposure after implementing the endpoint containment safeguard.
3
Calculate Annual Loss Avoided and Net Cost-Benefit
Loss Avoided = 75,000−25,000=50,00075,000 - 25,000 = 50,000; Net Benefit = 50,000−20,000=30,00050,000 - 20,000 = 30,000
Subtracts the annual safeguard cost from the annualized financial loss reduction to determine net value.

Anahtar Kavram

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
Bu soruyu puanla

Konular

Risk Identification, Assessment, and Response Strategies

Bu konudan daha fazla soru